Fix typo
Implement collection-wide hidden fields for /:collection

Uses the `hiddenFields` middleware to populate `req.fields`, which then
gets passed to the storage `list` method to inform mongo which fields to
remove from the response.
Move hidden field tests into their own file

These tests are starting to grow quite large, so it seems like they
deserve their own file to make it clear that this is a discrete feature.